Read the docs
TI-2026-31912 Aliases CVE-2026-43823

Double free in Apple swift-crypto

Priority HIGH 72CWE-415Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-415 and the CVSS impact.

Summary

When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00428 37th percentileScored 2026-11-07
Fix Fixed swift-crypto (Apple): 4.5.1Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Appleswift-cryptobefore 4.5.14.5.1Patch availableCNA
  • swift-crypto VendorApple Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apple:swift-crypto:*:*:*:*:*:swift:*:*3.2.0 – 4.5.1VulnerableApple
  • cpe:2.3:a:apple:swift-crypto:*:*:*:*:*:swift:*:* Versions 3.2.0 – 4.5.1 Vulnerable ·Apple

Remediation

  • Fix · CNA swift-crypto (Apple) Fixed in 4.5.1

Red Hat 2 advisories

  • RHSA-2026:45785 Released 2026-07-25 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images swift-lang-6.3.3-0.1.1.hum1@aarch64, swift-lang-6.3.3-0.1.1.hum1@src, swift-lang-6.3.3-0.1.1.hum1@x86_64 +2
  • RHSA-2026:45784 Released 2026-07-25 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nodejs24-1:24.18.0-0.5.hum1@aarch64, nodejs24-1:24.18.0-0.5.hum1@src, nodejs24-1:24.18.0-0.5.hum1@x86_64 +14

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:45784, RHSA-2026:45785
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43823
  2. 2026-10-23 Affected versions changed · Red Hat

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences